5 Proven Steps to Detect and Prevent Subdomain Takeover in OpenCart

Introduction

Subdomain takeover is a critical security vulnerability that occurs when a subdomain points to an external service that has been removed or no longer claims the subdomain.

Attackers can exploit this misconfiguration to serve malicious content under the trusted domain, leading to severe security breaches.

For OpenCart store owners, ensuring that all subdomains are correctly configured is essential to maintaining the integrity and trustworthiness of their e-commerce platform.

---

Understanding Subdomain Takeover in OpenCart

In the context of OpenCart, subdomain takeover can happen if, for example, a subdomain is set up to point to a third-party service (like a content delivery network, cloud service, or external blog) and that service is later discontinued without updating the DNS records.

This dangling DNS record becomes a potential entry point for attackers.

---

Step 1: Audit Your DNS Records Regularly

Regular DNS audits help identify subdomains pointing to deprecated or unclaimed services. Here’s how you can perform a DNS audit:

1. List All Subdomains: Compile a comprehensive list of all subdomains associated with your OpenCart store.
2. Check DNS Records: Use DNS lookup tools to verify where each subdomain points.
3. Identify Dangling Records: Look for CNAME records pointing to services that are no longer in use.

Example using a DNS lookup tool in Python:

import dns.resolver

def check_subdomain(subdomain):
    try:
        answers = dns.resolver.resolve(subdomain, 'CNAME')
        for rdata in answers:
            print(f"Subdomain {subdomain} points to {rdata.target}")
    except dns.resolver.NoAnswer:
        print(f"No CNAME record found for {subdomain}")
    except dns.resolver.NXDOMAIN:
        print(f"Subdomain {subdomain} does not exist")

# Example usage
check_subdomain("shop.example.com")

This script checks if a subdomain has a CNAME record and prints its target. If the target service is no longer active, it could indicate a takeover risk.

---

Step 2: Detect Unclaimed Subdomains

Once you have identified CNAME records pointing to external services, verify whether the target service is still active.

Methods to Check if a Subdomain is Vulnerable:

• Visit the subdomain in a web browser. If it shows a “404 Not Found” or “No such site” error, it may be unclaimed.
• Use cURL to check the response from the subdomain:

curl -I https://shop.example.com

If the response includes 404, NXDOMAIN, or CNAME with no A record, it might be vulnerable to takeover.

---

Step 3: Claim or Remove Vulnerable Subdomains

What to Do if You Find a Vulnerable Subdomain

• If the subdomain belongs to an external service (like Shopify, AWS S3, or Heroku), log into your account and reclaim it.
• If the service is no longer needed, delete the CNAME record from your DNS settings.
• If possible, redirect the subdomain to a safe location.

---

Step 4: Automate Subdomain Takeover Detection

To ensure continuous monitoring, you can automate the detection process with tools like Subjack, Subover, or a custom Python script.

Example: Using Subjack to Detect Takeovers

Install Subjack:

git clone https://github.com/haccer/subjack.git
cd subjack
go build

Run Subjack to check subdomains:

subjack -w subdomains.txt -t 20 -timeout 30 -o results.txt -ssl

If Subjack finds a subdomain takeover vulnerability, take immediate action to remove or reclaim it.

---

Step 5: Strengthen OpenCart Security

To minimize the risk of subdomain takeover in OpenCart, follow these best practices:

1. Use a Web Security Scanner

Regularly scan your OpenCart store for vulnerabilities. You can use our Website Vulnerability Scanner to detect security issues.

👉 Below is an example screenshot of our free tool’s webpage:

2. Monitor DNS Records Continuously

Set up alerts for DNS record changes using services like SecurityTrails or Cloudflare DNS Monitoring.

3. Conduct Regular Vulnerability Assessments

Perform frequent vulnerability assessments on your website to check Website Vulnerability. Our free tool provides a Website Vulnerability Assessment Report to help you secure your site.

👉 Here’s a screenshot of a website vulnerability assessment report checked by our tool:

---

Additional OpenCart Security Resources

For more OpenCart security insights, check out these guides:

• Prevent LDAP Injection in OpenCart
• Prevent NoSQL Injection in OpenCart
• Fix HTTP Parameter Pollution in OpenCart
• Enhance Transport Layer Protection in OpenCart
• Explore More OpenCart Security Tips on Our Blog

---

Conclusion

Subdomain takeover in OpenCart is a serious security risk that can lead to phishing attacks, malware distribution, and data theft.

By regularly auditing DNS records, detecting unclaimed subdomains, automating security checks, and following best practices, you can protect your OpenCart store from this threat.

If you’re unsure about your website’s security, run a free scan using our tool for a quick Website Security test today!

---